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AMENDMENT 


Docket No.: 881075/3 


IN THE TITLE : 

Please amend the title of the invention by including "AND SECURITY" as 
follows (a substitute page 1 of the application, showing the amended title, is enclosed): 

Method and Apparatus for Verifying the Integrity and Security of Computer 
Networks and Implementation'of Counter Measures 

IN THE CLAIMS : 

Please amend claims 1, 5, 8, 1 1, 13, 17, 21 and 22 as follows: 
1 . (Amended) A security system for a computer connected to a network of computers 
comprising: 

at least one security subsystem associated with said computer, said subsystem being 
configured to monitor events across said network of computers in its entirety and to detect 
attacks on said computer; 

and a secure link between said security subsystem and a master system enabling data 
communication therebetween; /wherein 

said master system monitors said security subsystem through said secure link and 
registers information pertainijig to attacks detected by said security subsystem. 


5. (Amended) A network security system for a target network of computers comprising: 
at least one security subsystem associated with said target network, said subsystem being 

configured to monitor evenfsacross said network of computers in its entirety and to detect 

attacks on said network/and 
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a secure link between said security subsystem and a master system enabling data 

communication therebetween; wherein 

said master system monitcfrs said security subsystem through said secure link and 

registers information pertaining Ao the attacks detected by said security subsystem. 


8. (Amended) A network security system for a target network of computers comprising: 
at least one security subsystem associated with said target network and configured to 
monitor events across said target network in its entirety and to detect and register attacks on said 
target network; 

a secure link for da^a communication between said security subsystem and said master 
system; and 

testing means associated with said master system for generating pseudo-attacks on said 
target network initiated b^ said master system and detectable by said security subsystem; 
wherein 

said master systeAi monitors said security subsystem through said secure link by 
comparing the pseudo-ai tacks generated by said testing means to the detected attacks registered 
by said security subsystem. 


1 1 (Amended) A method for monitoring the integrity of a security subsystem associated 
with a target network of computers and configured to detect attacks on said network of 
computers comprising: 

monitoring events acriss said target network in its entirety using said security subsystem; 
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establishing a Secure link for the transfer of data between said security subsystem and a 

master system hierarcl ically independent from said security subsystem; 


monitoring the 


itatus of said security subsystem through said secure link; and 


registering information pertaining to the status of said security subsystem. 


13. (Amended) A security system for a computer connected to a computer network 
comprising: 

at least one detection means associated with said computer, said detection means being 
configured to monitor events across said computer network in its entirety and to detect an attack 
on said computer; 

a master security system located outside said computer network; and 
a secure link between said detection means and said master security system enabling data 

wherein 

said master security system monitors said detection means through said secure link and 
registers information pertaining to attacks detected by said detection means. 


communication therebetween; 


17. (Amended) A ne1 work security system for a target network of computers comprising: 
at least one detection means associated with said target network, said detection means 
being configured to monitoj- events across said computer network in its entirety and to detect an 
attack on said network; 

a master security system located outside said network; and 

a secure link between said detection means and said master security system enabling data 
communication therebetween; wherein 
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said master securijy^ystem monitors said detection means through said secure link and 

registers information pertaining to attacks detected by said detection means. 



21 . (Amended) A method for monitoring the integrity of a detection means associated 
with a computer, said compute r being connected to a computer network, and configured to detect 
an attack on said computer, said method comprising the steps of: 

monitoring events across said target network in its entirety using said detection means; 

establishing a secure link for the transfer of data between said detection means and a 
master system hierarchically independent from said detection means; 

monitoring the status of said detection means through said secure link; and 

registering information pertaining to the status of said detection means. 


22. (Amended) A method for monitoring the integrity of a detection means associated 
with a target network of compute rs and configured to detect an attack on said network of 
computers comprising the steps of: 

monitoring events across said target network in its entirety using said detection means; 
establishing a secure link tor the transfer of data between said detection means and a 
master system hierarchically independent from said detection means; 

monitoring the status of said detection means through said secure link; and 
registering information pertaining to the status of said detection means. 
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